cacert-gosigner/x509/signing/signing_test.go

118 lines
3.4 KiB
Go

package signing_test
import (
"crypto"
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"math/big"
rand2 "math/rand"
"testing"
"time"
"git.cacert.org/cacert-gosigner/x509/signing"
"github.com/stretchr/testify/assert"
)
type testRepo struct {
certs map[string]x509.Certificate
}
func (r *testRepo) StoreCertificate(c *signing.CertificateSigned) error {
cert := c.Certificate()
r.certs[cert.SerialNumber.Text(16)] = *cert
return nil
}
type testSigner struct {
key crypto.PrivateKey
certificate *x509.Certificate
}
type testSignerResponse struct {
certificate *x509.Certificate
}
func (t testSignerResponse) Certificate() *x509.Certificate {
return t.certificate
}
func newTestSignerResponse(certificate *x509.Certificate) *testSignerResponse {
return &testSignerResponse{certificate: certificate}
}
func (s *testSigner) SignCertificate(request *signing.SignerRequest) (signing.SignerResponse, error) {
startDate := time.Now().Add(-1 * time.Minute)
template := &x509.Certificate{
Subject: request.SubjectDN(),
SerialNumber: big.NewInt(rand2.Int63()),
EmailAddresses: request.Emails(),
NotBefore: startDate,
NotAfter: startDate.Add(request.Duration()),
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageDataEncipherment,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageEmailProtection},
SignatureAlgorithm: request.SignatureAlgorithm(),
}
certBytes, err := x509.CreateCertificate(rand.Reader, template, s.certificate, request.Csr().PublicKey, s.key)
if err != nil {
return nil, err
}
certificate, err := x509.ParseCertificate(certBytes)
if err != nil {
return nil, err
}
return newTestSignerResponse(certificate), nil
}
func TestSigning(t *testing.T) {
rand2.Seed(time.Now().UnixMilli())
testRepository := testRepo{certs: make(map[string]x509.Certificate)}
testSigner := newTestSigner(t)
s := signing.NewX509Signing(testSigner, &testRepository)
csrKey, err := rsa.GenerateKey(rand.Reader, 3072)
if err != nil {
t.Errorf("could not generate key pair")
}
csrTemplate := &x509.CertificateRequest{PublicKey: csrKey.Public()}
csrBytes, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, csrKey)
if err != nil {
t.Error(err)
}
testRequest := signing.NewRequestSignature(csrBytes, "Test Subject", []string{"test@example.org"}, nil, 365*24*time.Hour, x509.SHA384WithRSA)
signed, err := s.Sign(testRequest)
if err != nil {
t.Error(err)
}
cert := signed.Certificate()
assert.Contains(t, testRepository.certs, cert.SerialNumber.Text(16))
assert.Equal(t, cert.Subject.CommonName, "Test Subject")
assert.Contains(t, cert.EmailAddresses, "test@example.org")
}
func newTestSigner(t *testing.T) *testSigner {
t.Helper()
caKey, err := rsa.GenerateKey(rand.Reader, 3072)
if err != nil {
t.Fatalf("could not generate key pair: %v", err)
}
caTemplate := &x509.Certificate{Subject: pkix.Name{CommonName: "Test CA"}, SerialNumber: big.NewInt(rand2.Int63())}
certificateBytes, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, caKey.Public(), caKey)
if err != nil {
t.Fatalf("could not self-sign CA certificate: %v", err)
}
caCertificate, err := x509.ParseCertificate(certificateBytes)
if err != nil {
t.Fatalf("could not create test CA certificate: %v", err)
}
return &testSigner{key: caKey, certificate: caCertificate}
}